PT-2011-1348 · Pentaho · Pentaho Bi Server

Published 2011-09-13 · Updated 2018-10-10 · CVE-2009-5099

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pentaho BI Server versions 1.7.0.1062 and earlier

Description The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the outputType parameter.

Recommendations For versions 1.7.0.1062 and earlier, avoid using the outputType parameter in affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-5099

Affected Products

Pentaho Bi Server

References · 6

• 🔥 http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities · Exploit
• 🔥 http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel · Exploit
• http://secunia.com/advisories/37024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-5099 · Security Note
• http://vupen.com/english/advisories/2009/2972 · Vendor Advisory
• http://securityfocus.com/archive/1/507168/100/0/threaded · Note